Worrying. We could have an emergency pool of one node per cpu, and disable apf if we use it until it's returned. But that's a lot of complexity for an edge case, so a simpler solution would be welcome.